no credentials   GET /documents/1  -> 401
alice            GET /documents/1  -> 200
carol            GET /documents/1  -> 403
alice            GET /documents/99 -> 403
admin            GET /documents/99 -> 403
bob              PUT /documents/1?title=x -> 403
alice            PUT /documents/1?title=x -> 200